CVE-2022-1100 - A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 14.9.0 prior to 14.9.2

Back Back to CVE browser

MEDIUM

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 14.9.0 prior to 14.9.2

Published Apr 4, 2022

4.3

MEDIUM

CVSS 3.1

EPSS 1.03%

Description

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 14.9.0 prior to 14.9.2. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage.

Affected products

Vendor GitLab Product GitLab Default
n/a
- Version
  >=13.1, <14.7.7
  Status
  affected
  Constraints
  -
- Version
  >=14.8, <14.8.5
  Status
  affected
  Constraints
  -
- Version
  >=14.9, <14.9.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

n/a

Version	Status	Constraints
>=13.1, <14.7.7	affected	-
>=14.8, <14.8.5	affected	-
>=14.9, <14.9.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-772

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-24443
Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1100.json
x_refsource_CONFIRMVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/273771
x_refsource_MISCBroken Link

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-24443		Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1100.json		x_refsource_CONFIRMVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/273771		x_refsource_MISCBroken Link